build: rego source policies by dvdksn · Pull Request #23782 · docker/docs

dvdksn · 2025-11-27T13:27:54Z

Description

Buildx support for rego policies for validating build inputs (local, http, git, image).

Preview: https://deploy-preview-23782--docsdocker.netlify.app/build/policies/

Related issues or tickets

netlify · 2025-11-27T13:28:07Z

✅ Deploy Preview for docsdocker ready!

Name	Link
🔨 Latest commit	`2c7b95a`
🔍 Latest deploy log	https://app.netlify.com/projects/docsdocker/deploys/6979d993f0c31300083b6746
😎 Deploy Preview	https://deploy-preview-23782--docsdocker.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

tonistiigi · 2026-01-20T20:21:20Z

+```
+
+When using Sigstore signatures, additional fields are available under
+`input.image.signature` (singular) with details about the signing workflow.


Uuh I reckon this was a result of me starting to preemptively doc some fields before I was able to test. Then Claude went and mangled things.

tonistiigi · 2026-01-20T20:23:23Z

+}
+```
+
+#### `input.git.commitChecksum`


There is also checksumisAnnotatedTag.

Adding these and a couple other fields I noticed were missing. Not adding fullUrl and isSha256 just yet - I noticed they exist but I'm not really able to test those.

Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>

akristen · 2026-01-27T15:57:43Z

+$ docker buildx policy test --filename app.Dockerfile .
+```
+
+This loads `app.Dockerfile.rego` and runs `*_test.rego` files against it.


Same as above. What is the expected outcome? A short sentence might help wrap up what to expect

usha-mandya · 2026-01-27T15:59:51Z

Left some minor comments @dvdksn. Looks great overall!

akristen · 2026-01-27T16:10:15Z

+> like `allow if { input.image; print(...) }` only prints for image inputs,
+> not for Git repos, HTTP downloads, or local files.
+
+## Common issues


What do we think about separating debugging reference from troubleshooting? It doesn't have to be for teh release, but maybe for future work. I think while the two types of info are similar, debugging reads as things a user can do to find an unknown issue whereas troubleshooting are topics that we know are common missteps.
I also might include specific error codes of some kind, or specific error message a user might encounter related to these topics if we have that info readily available. Not a blocker just an idea!

akristen

These are really informative docs w/ a lot of good details. Some copy level things beyond the general suggestions i left in the PR:

Our style guide suggests we use - construction sparingly. I might get a list of all the times you use a - and rework those sentences to use :s, semicolons, commons, whatever you want.
Do we always capitalize git? I didn't see anything in our style guide on guidance and I could be wrong... might be handy for me to know, lol.

Overall the one thing I might add to the introduction is more frontloaded context about WHO WHAT WHEN re: creating build policies. Is it something we recommend for larger enterprise orgs? Individual devs? What is the purpose of including these in production or dev: is it better security and compliance, or are there other benefits?

Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>

resolved

usha-mandya

LGTM

dvdksn added the status/do-not-merge Pull requests that are awaiting some event or decision before they can be merged. label Nov 27, 2025

github-actionsBot added area/build Relates to Dockerfiles or docker build command area/tests labels Nov 27, 2025

dvdksn force-pushed the build-input-policy branch from 640026d to b152a76Compare January 16, 2026 13:38

github-actionsBot added the area/cli Relates to the CLI client label Jan 16, 2026

dvdksn force-pushed the build-input-policy branch 2 times, most recently from 1dcccf6 to 7741d9bCompare January 20, 2026 14:57

dvdksn requested a review from tonistiigi January 20, 2026 14:59

dvdksn marked this pull request as ready for review January 20, 2026 14:59

dvdksn force-pushed the build-input-policy branch 2 times, most recently from 9ef9e13 to 04835cdCompare January 20, 2026 15:22

dvdksn changed the title ~~[WIP] build: rego source policies~~build: rego source policiesJan 20, 2026

dvdksn force-pushed the build-input-policy branch from 04835cd to 92feb6fCompare January 20, 2026 15:34

tonistiigi reviewed Jan 20, 2026
View reviewed changes

dvdksn force-pushed the build-input-policy branch from 92feb6f to 2040f30Compare January 21, 2026 08:45

BrewTestBot mentioned this pull request Jan 22, 2026
docker-buildx 0.31.0 Homebrew/homebrew-core#263940
Merged

rancherbot mentioned this pull request Jan 22, 2026
rddepman: bump dockerBuildx from 0.30.1 to 0.31.0 rancher-sandbox/rancher-desktop#9782
Merged

dvdksn force-pushed the build-input-policy branch from 2040f30 to d94ec3eCompare January 26, 2026 13:14

github-actionsBot added dependencies Vendoring, packaging updates area/config labels Jan 26, 2026

dvdksn removed status/do-not-merge Pull requests that are awaiting some event or decision before they can be merged. dependencies Vendoring, packaging updates area/config labels Jan 26, 2026

dvdksn requested a review from a teamJanuary 26, 2026 13:14

dvdksn added the status/review Pull requests that are ready for review label Jan 26, 2026

dvdksn mentioned this pull request Jan 27, 2026
go.mod: use tool directive and no replace#24025
Merged
3 tasks

build: add stubs for buildx policy commands
ae09e52
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>

dvdksn force-pushed the build-input-policy branch from d94ec3e to d803575Compare January 27, 2026 14:25

usha-mandya reviewed Jan 27, 2026
View reviewed changes

Comment threadcontent/manuals/build/policies/_index.md Outdated
Comment threadcontent/manuals/build/policies/_index.md Outdated
Comment threadcontent/manuals/build/policies/_index.md